What Is Onion Routing in Tor Network

Onion routing is a privacy-focused communication technique that enables anonymous data exchange over a public network. By encrypting network traffic in multiple layers—resembling the layers of an onion—and directing it through a distributed sequence of volunteer-run nodes, onion routing conceals both the origin and destination of the data. This article explains the underlying mechanism of onion routing, how data travels across the Tor network, and why this design provides robust online anonymity.

The Core Concept of Onion Routing

In standard internet routing, packets travel directly from the sender to the receiver, exposing IP addresses and metadata to intermediate internet service providers (ISPs) and network observers. Onion routing breaks this direct connection by bouncing traffic through multiple intermediary relays.

Before data leaves the user’s device, the Tor client encrypts the payload multiple times using the public keys of the selected relays. Each relay along the path only possesses the decryption key corresponding to its own layer. As data moves from one node to the next, each node peels away a single layer of encryption to reveal only the routing instructions for the next hop.

The Three-Node Circuit

A standard Tor circuit consists of three distinct nodes:

  1. The Guard (Entry) Node: This is the first relay in the chain. It receives the encrypted packet directly from the user. The guard node knows the sender’s real IP address, but because the remaining data is encrypted, it does not know the final destination or the actual content of the message.
  2. The Middle Relay: The middle node receives the packet from the guard node and removes the next layer of encryption. It only knows which node sent the packet (the guard) and which node should receive it next (the exit). It knows neither the original sender nor the final destination.
  3. The Exit Node: The final relay removes the last layer of encryption and forwards the raw data to the intended destination (such as a website). The exit node knows the destination server, but it has no knowledge of the original sender’s IP address.

Step-by-Step Data Flow

  1. Circuit Establishment: The Tor client downloads a directory of available relays from directory authorities and chooses an entry node, a middle node, and an exit node.
  2. Layered Encryption: The client negotiates separate encryption keys with each of the three nodes. It then encrypts the message first with the exit node’s key, then with the middle node’s key, and finally with the guard node’s key.
  3. Transmission: The packet is sent to the guard node, which strips off the outer layer and forwards it to the middle node.
  4. Relay Decryption: The middle node strips off the second layer and forwards the packet to the exit node.
  5. Delivery: The exit node strips off the innermost layer and delivers the original request to the destination web server. The return traffic follows the reverse path, with each node adding a layer of encryption until the user’s client decrypts all layers.

Why the Design Ensures Anonymity

No single relay in the Tor circuit possesses complete information about the transaction. The entry node knows who is connecting but not where they are going. The exit node knows where the traffic is going but not who sent it. Because no individual node can link the source to the destination, user anonymity is preserved even if one of the nodes is compromised or malicious.